In today’s digitally driven landscape, robust Information Technology (IT) risk assessment practices are essential for safeguarding systems, digital communication, and data. This paper introduces “AssessITS,” an act...In today’s digitally driven landscape, robust Information Technology (IT) risk assessment practices are essential for safeguarding systems, digital communication, and data. This paper introduces “AssessITS,” an actionable method designed to provide organizations with comprehensive guidelines for conducting IT and cybersecurity risk assessments. Drawing extensively from NIST 800-30 Rev 1, COBIT 5, and ISO 31000, “AssessITS” bridges the gap between high-level theoretical standards and practical implementation challenges. The paper outlines a step-by-step methodology that organizations can simply adopt to systematically identify, analyze, and mitigate IT risks. By simplifying complex principles into actionable procedures, this framework equips practitioners with the tools needed to perform risk assessments independently, without too much reliance on external vendors. The guidelines are developed to be straightforward, integrating practical evaluation metrics that allow for the precise quantification of asset values, threat levels, vulnerabilities, and impacts on confidentiality, integrity, and availability. This approach ensures that the risk assessment process is not only comprehensive but also accessible, enabling decision-makers to implement effective risk mitigation strategies customized to their unique operational contexts. “AssessITS” aims to enable organizations to enhance their IT security strength through practical, actionable guidance based on internationally recognized standards.展开更多
Identification of security risk factors for small reservoirs is the basis for implementation of early warning systems.The manner of identification of the factors for small reservoirs is of practical significance when ...Identification of security risk factors for small reservoirs is the basis for implementation of early warning systems.The manner of identification of the factors for small reservoirs is of practical significance when data are incomplete.The existing grey relational models have some disadvantages in measuring the correlation between categorical data sequences.To this end,this paper introduces a new grey relational model to analyze heterogeneous data.In this study,a set of security risk factors for small reservoirs was first constructed based on theoretical analysis,and heterogeneous data of these factors were recorded as sequences.The sequences were regarded as random variables,and the information entropy and conditional entropy between sequences were measured to analyze the relational degree between risk factors.Then,a new grey relational analysis model for heterogeneous data was constructed,and a comprehensive security risk factor identification method was developed.A case study of small reservoirs in Guangxi Zhuang Autonomous Region in China shows that the model constructed in this study is applicable to security risk factor identification for small reservoirs with heterogeneous and sparse data.展开更多
The development of the Internet of Things(IoT)calls for a comprehensive in-formation security evaluation framework to quantitatively measure the safety score and risk(S&R)value of the network urgently.In this pape...The development of the Internet of Things(IoT)calls for a comprehensive in-formation security evaluation framework to quantitatively measure the safety score and risk(S&R)value of the network urgently.In this paper,we summarize the architecture and vulnerability in IoT and propose a comprehensive information security evaluation model based on multi-level decomposition feedback.The evaluation model provides an idea for information security evaluation of IoT and guides the security decision maker for dynamic protection.Firstly,we establish an overall evaluation indicator system that includes four primary indicators of threat information,asset,vulnerability,and management,respectively.It also includes eleven secondary indicators of system protection rate,attack detection rate,confidentiality,availability,controllability,identifiability,number of vulnerabilities,vulnerability hazard level,staff organization,enterprise grading and service continuity,respectively.Then,we build the core algorithm to enable the evaluation model,wherein a novel weighting technique is developed and a quantitative method is proposed to measure the S&R value.Moreover,in order to better supervise the performance of the proposed evaluation model,we present four novel indicators includes residual risk,continuous conformity of residual risk,head-to-tail consistency and decrease ratio,respectively.Simulation results show the advantages of the proposed model in the evaluation of information security for IoT.展开更多
The paper describes a simplified GIS approach, for landslides risk assessment in the Province of Bergamo, developed for a GIS degree thesis at the faculty of Engineering of the University of Bergamo. The subject has b...The paper describes a simplified GIS approach, for landslides risk assessment in the Province of Bergamo, developed for a GIS degree thesis at the faculty of Engineering of the University of Bergamo. The subject has been and still is largely studied by many researchers with the aid of rigorous mathematical/statistical analysis tools. This work follows some procedures carried out by other studies, but at the end it has been decided to adopt a simple, fast and not rigorous way to find a solution. A following analysis, on the higher risk areas identified, has also been performed to test their reliability, allowing achieving satisfactory results. It has been planned to study the risk model more thoroughly, by taking into account other triggering causes for landslide susceptibility and to try also a rigorous approach, so as to get a better idea of the results achieved so far and how to improve them.展开更多
为了辨识油气智慧管道系统中存在的信息安全风险,通过基于系统论事故分析模型(systems-theoretic accident modeling and process,STAMP)的方法,对油气智慧管道系统的信息物理安全进行全面评估与分析。首先,系统综合分析了油气智慧管道...为了辨识油气智慧管道系统中存在的信息安全风险,通过基于系统论事故分析模型(systems-theoretic accident modeling and process,STAMP)的方法,对油气智慧管道系统的信息物理安全进行全面评估与分析。首先,系统综合分析了油气智慧管道涉及的设备、设施、工艺、元件,评估其安全性。其次,通过建立STAMP模型,深入分析了各层级、元件之间的反馈信息与控制动作,形成了明确的控制反馈回路,突显了元件之间的关联与控制关系。在此基础上,系统辨识出了潜在的信息风险因素,推导并构建了可能发生的系统失效场景。以天然气输气首站油气智慧管道系统为例,研究验证了基于STAMP模型的可行性和有效性。结果显示,该方法不仅直观地描述了元件之间的关联与控制关系,而且从物理层功能安全的角度全面考虑了信息风险,特别凸显了过程控制系统(process control systems,PCS)及易受攻击的操作员站。与传统方法相比,本研究所提出的方法将信息物理安全风险因素的识别率提升至80%以上,提高了40%以上,有助于避免不必要的安全措施冗余设计,提高了安全风险管控的准确性。展开更多
文摘In today’s digitally driven landscape, robust Information Technology (IT) risk assessment practices are essential for safeguarding systems, digital communication, and data. This paper introduces “AssessITS,” an actionable method designed to provide organizations with comprehensive guidelines for conducting IT and cybersecurity risk assessments. Drawing extensively from NIST 800-30 Rev 1, COBIT 5, and ISO 31000, “AssessITS” bridges the gap between high-level theoretical standards and practical implementation challenges. The paper outlines a step-by-step methodology that organizations can simply adopt to systematically identify, analyze, and mitigate IT risks. By simplifying complex principles into actionable procedures, this framework equips practitioners with the tools needed to perform risk assessments independently, without too much reliance on external vendors. The guidelines are developed to be straightforward, integrating practical evaluation metrics that allow for the precise quantification of asset values, threat levels, vulnerabilities, and impacts on confidentiality, integrity, and availability. This approach ensures that the risk assessment process is not only comprehensive but also accessible, enabling decision-makers to implement effective risk mitigation strategies customized to their unique operational contexts. “AssessITS” aims to enable organizations to enhance their IT security strength through practical, actionable guidance based on internationally recognized standards.
基金supported by the National Nature Science Foundation of China(Grant No.71401052)the National Social Science Foundation of China(Grant No.17BGL156)the Key Project of the National Social Science Foundation of China(Grant No.14AZD024)
文摘Identification of security risk factors for small reservoirs is the basis for implementation of early warning systems.The manner of identification of the factors for small reservoirs is of practical significance when data are incomplete.The existing grey relational models have some disadvantages in measuring the correlation between categorical data sequences.To this end,this paper introduces a new grey relational model to analyze heterogeneous data.In this study,a set of security risk factors for small reservoirs was first constructed based on theoretical analysis,and heterogeneous data of these factors were recorded as sequences.The sequences were regarded as random variables,and the information entropy and conditional entropy between sequences were measured to analyze the relational degree between risk factors.Then,a new grey relational analysis model for heterogeneous data was constructed,and a comprehensive security risk factor identification method was developed.A case study of small reservoirs in Guangxi Zhuang Autonomous Region in China shows that the model constructed in this study is applicable to security risk factor identification for small reservoirs with heterogeneous and sparse data.
基金This work was supported in part by National Key R&D Program of China under Grant 2019YFB2102400in part by the BUPT Excellent Ph.D.Students Foundation under Grant CX2019117.
文摘The development of the Internet of Things(IoT)calls for a comprehensive in-formation security evaluation framework to quantitatively measure the safety score and risk(S&R)value of the network urgently.In this paper,we summarize the architecture and vulnerability in IoT and propose a comprehensive information security evaluation model based on multi-level decomposition feedback.The evaluation model provides an idea for information security evaluation of IoT and guides the security decision maker for dynamic protection.Firstly,we establish an overall evaluation indicator system that includes four primary indicators of threat information,asset,vulnerability,and management,respectively.It also includes eleven secondary indicators of system protection rate,attack detection rate,confidentiality,availability,controllability,identifiability,number of vulnerabilities,vulnerability hazard level,staff organization,enterprise grading and service continuity,respectively.Then,we build the core algorithm to enable the evaluation model,wherein a novel weighting technique is developed and a quantitative method is proposed to measure the S&R value.Moreover,in order to better supervise the performance of the proposed evaluation model,we present four novel indicators includes residual risk,continuous conformity of residual risk,head-to-tail consistency and decrease ratio,respectively.Simulation results show the advantages of the proposed model in the evaluation of information security for IoT.
文摘The paper describes a simplified GIS approach, for landslides risk assessment in the Province of Bergamo, developed for a GIS degree thesis at the faculty of Engineering of the University of Bergamo. The subject has been and still is largely studied by many researchers with the aid of rigorous mathematical/statistical analysis tools. This work follows some procedures carried out by other studies, but at the end it has been decided to adopt a simple, fast and not rigorous way to find a solution. A following analysis, on the higher risk areas identified, has also been performed to test their reliability, allowing achieving satisfactory results. It has been planned to study the risk model more thoroughly, by taking into account other triggering causes for landslide susceptibility and to try also a rigorous approach, so as to get a better idea of the results achieved so far and how to improve them.
文摘为了辨识油气智慧管道系统中存在的信息安全风险,通过基于系统论事故分析模型(systems-theoretic accident modeling and process,STAMP)的方法,对油气智慧管道系统的信息物理安全进行全面评估与分析。首先,系统综合分析了油气智慧管道涉及的设备、设施、工艺、元件,评估其安全性。其次,通过建立STAMP模型,深入分析了各层级、元件之间的反馈信息与控制动作,形成了明确的控制反馈回路,突显了元件之间的关联与控制关系。在此基础上,系统辨识出了潜在的信息风险因素,推导并构建了可能发生的系统失效场景。以天然气输气首站油气智慧管道系统为例,研究验证了基于STAMP模型的可行性和有效性。结果显示,该方法不仅直观地描述了元件之间的关联与控制关系,而且从物理层功能安全的角度全面考虑了信息风险,特别凸显了过程控制系统(process control systems,PCS)及易受攻击的操作员站。与传统方法相比,本研究所提出的方法将信息物理安全风险因素的识别率提升至80%以上,提高了40%以上,有助于避免不必要的安全措施冗余设计,提高了安全风险管控的准确性。
